What are the potential issues with using "include" in PHP for loading different pages based on user input?

One potential issue with using "include" in PHP for loading different pages based on user input is the risk of directory traversal attacks if the user input is not properly sanitized. To solve this issue, it is important to validate and sanitize the user input before using it in the "include" statement. 

$user_input = $_GET['page'];

// Validate and sanitize the user input
$allowed_pages = ['home', 'about', 'contact'];
if (in_array($user_input, $allowed_pages)) {
    $page = $user_input;
} else {
    $page = 'error'; // Default page for invalid input
}

// Include the selected page
include($page . '.php');

Keywords

include PHP security user input code injection

Related Questions